Which statement describes the difference between containment and eradication?

• A. Containment preserves evidence; eradication removes the threat and artifacts from the environment
• B. Containment limits spread and preserves evidence; eradication removes the threat and artifacts from the environment
• C. Containment and eradication are the same
• D. Containment eliminates threats; eradication only blocks them

Answer: (B)

Containment aims to stop the incident from spreading while keeping enough data intact for investigation, whereas eradication means removing the threat itself and all associated artifacts from the environment. When you contain, you might isolate affected systems, segment networks, and block attacker activity to prevent new hosts from being compromised, all while preserving logs, memory dumps, and other evidence for forensic analysis. Eradication goes beyond containment by actually removing the malicious code and persistence mechanisms, cleaning up artifacts, applying patches or configurations to prevent reinfection, and then verifying that no traces remain.

This makes the statement the best choice because it clearly links containment to limiting spread and preserving evidence, and it ties eradication to removing the threat and artifacts. The other options lack or reverse these nuances—for example, they may omit the spread-limiting aspect, or imply containment and eradication are the same, or say the opposite of what each term does.